✉
Phishing triage
SecurityClassify a reported email as Phishing / Spam / Safe with the indicators (spoofing, links, urgency) and the action — built for real-time, high-volume inbox triage.
The routing recipe
Job typeClassification / routingPolicyFastest that passes
routes to
GPT-OSS 20B groq
groq:openai/gpt-oss-20b
92.7
match score
84.6
task fit
100
cost
96.4
speed
Why this model from benchmarks & capabilities
- "Classification / routing" leans hardest on instruction; GPT-OSS 20B scores 78/100 there — #23 of 40.
- Strength on this class of work shows up on IFEval, MMLU (zero-shot), where OpenAI (open-weight) models are competitive.
- Cost: free tier. Speed: ~1000 tok/s on Groq LPU.
- Chosen over Llama 3.1 8B Instant for higher task-fit (84.6 vs 75.6) & cheaper.
| Capability the job needs | Weight | GPT-OSS 20B | Catalog rank |
|---|---|---|---|
| instruction | 0.90 | #23 of 40 | |
| speed | 0.90 | #1 of 40 | |
| knowledge | 0.30 | #26 of 40 |
Relevant benchmarksIFEval MMLU (zero-shot)
EconomicsCost: free tier.
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over Llama 3.1 8B Instant for higher task-fit (84.6 vs 75.6) & cheaper. (Llama 3.1 8B Instant, score 86.3)
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over Llama 3.1 8B Instant for higher task-fit (84.6 vs 75.6) & cheaper. (Llama 3.1 8B Instant, score 86.3)
Example result
Sample input ▾
From: [email protected] — Subject: "Your password expires today." Body: "Click here to keep your account active: http://bit.ly/xy12. Failure to act will lock your mailbox in 2 hours."
Verdict: PHISHING (confidence 96).
Indicators: (1) look-alike domain "micros0ft-secure.com" (zero-for-o); (2) shortened link hiding the real destination; (3) manufactured urgency + account-lock threat.
Action: Quarantine and Warn user. ESCALATE — credential-harvesting pattern.
Test it on your own data